This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 526074 - (CVE-2009-2948) CVE-2009-2948 samba: information disclosure in suid mount.cifs
CVE-2009-2948 samba: information disclosure in suid mount.cifs
Status: CLOSED ERRATA
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity low
: ---
: ---
Assigned To: Red Hat Product Security
impact=low,source=vendorsec,reported=...
: Security
Depends On: 526658 526659 526660 526661 526663
Blocks:
  Show dependency treegraph
 
Reported: 2009-09-28 12:58 EDT by Vincent Danen
Modified: 2011-01-04 09:13 EST (History)
6 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2009-11-19 10:00:57 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)
upstream patches to correct CVE-2009-2948 for samba 3.0.36, 3.2.14, 3.4.1 (3.66 KB, application/x-bzip2)
2009-09-28 13:05 EDT, Vincent Danen
no flags Details
patch -- backports of upstream patches (17.29 KB, patch)
2009-10-02 10:35 EDT, Jeff Layton
no flags Details | Diff

  None (edit)
Description Vincent Danen 2009-09-28 12:58:06 EDT
A flaw in the mount.cifs program, when installed suid, prevents it from checking user's privileges when provided a password or credential path, prior to obtaining root privileges.  This allows a user to use a password or credential file to which they would not have access.  As well, when the --verbose option is provided, the user can view the first line of that file.
Comment 1 Vincent Danen 2009-09-28 13:05:35 EDT
Created attachment 362916 [details]
upstream patches to correct CVE-2009-2948 for samba 3.0.36, 3.2.14, 3.4.1
Comment 2 Vincent Danen 2009-09-28 13:11:58 EDT
This issue does not affect Red Hat Enterprise Linux 4 and 5 by default as mount.cifs is not provided with the setuid bit enabled.  If a user has turned on the setuid bit (via 'chmod +s /sbin/mount.cifs'), they would be affected by this issue and can workaround the problem by removing the setuid bit.

Red Hat Enterprise Linux 3 does not provide the mount.cifs program.

The Red Hat Security Response Team has rated this issue as having low security impact, a future update may address this flaw.  More information regarding issue severity can be found here:

http://www.redhat.com/security/updates/classification/
Comment 3 Tomas Hoger 2009-10-01 06:08:10 EDT
Upstream advisory:
  http://www.samba.org/samba/security/CVE-2009-2948.html

Fixed upstream in versions: 3.0.37, 3.2.15, 3.3.8 and 3.4.2
Comment 6 Jeff Layton 2009-10-02 10:35:37 EDT
Created attachment 363489 [details]
patch -- backports of upstream patches

This is a backport of the 2 upstream patches for this CVE, plus an older patch that I pulled in to make the others apply more cleanly.

I've given it some basic smoke testing and it seems to work ok.
Comment 7 Fedora Update System 2009-10-03 14:57:34 EDT
samba-3.2.15-0.36.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 8 Fedora Update System 2009-10-03 14:59:24 EDT
samba-3.4.2-0.42.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.
Comment 9 errata-xmlrpc 2009-10-27 13:12:03 EDT
This issue has been addressed in following products:

  Red Hat Enterprise Linux 4
  Red Hat Enterprise Linux 5

Via RHSA-2009:1529 https://rhn.redhat.com/errata/RHSA-2009-1529.html
Comment 10 errata-xmlrpc 2009-11-16 10:40:03 EST
This issue has been addressed in following products:

  Extras for Red Hat Enterprise Linux 5

Via RHSA-2009:1585 https://rhn.redhat.com/errata/RHSA-2009-1585.html

Note You need to log in before you can comment on or make changes to this bug.